fix(ci): publish the local release tarball

[vincentkoc]

What Problem This Solves

Fixes an issue where the release workflow passed the generated tarball to npm
without an explicit relative-path prefix. npm interpreted
release-artifact/openclaw-fs-safe-0.4.6.tgz as GitHub repository shorthand and
attempted an SSH clone instead of publishing the local artifact.

Failed release run:
https://github.com/openclaw/fs-safe/actions/runs/30086956227

Why This Change Was Made

Publish ./release-artifact/${PACKAGE_FILENAME} so npm unambiguously receives a
local tarball. The package, trusted-publisher configuration, and provenance
requirements are unchanged.

User Impact

This unblocks publication of @openclaw/fs-safe@0.4.6. Runtime package behavior
is unchanged by this repair.

Evidence

• Packed the release artifact and ran real
  npm publish --dry-run --ignore-scripts ./release-artifact/<tarball> --access public; npm recognized @openclaw/fs-safe@0.4.6 and prepared the
  public publish.

• git diff --check

• Autoreview: clean, no accepted or actionable findings.

• The failed workflow log shows npm attempting
  git ls-remote ssh://git@github.com/release-artifact/...tgz.git with the old
  path.

• Tests added or updated when behavior changed

• Security and compatibility impact considered

• CHANGELOG.md updated when release-relevant

• No credentials, private paths, private hosts, or sensitive contents included

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix(ci): publish the local release tarball This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.